jdk: 21.0.7+6 -> jdk-21.0.8+9

[deftdawg]

21.0.7+6 is effected by CVE-2025-30749 which appears on Grype scans; 21.0.8 is listed as a fixed version.

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.

Ping maintainers: @edwtjo @Infinidoge @chayleaf @FliegendeWurst @tomodachi94

[deftdawg]

jdk-21.0.8-ga doesn't parse with an error about how 'a' is not a valid numerical value for VERSION_BUILD (presumably from -ga) failing at the configure step similar to this error adoptium/temurin-build#3911

Bumped version to jdk-21.0.8+9 for retest

EDIT: this tag worked (it's the same commit as the -ga tag also)

[deftdawg]

cc: @NixOS/java -- This patch addresses a CVE from a few weeks ago, can it be merged?

Any folks who encounter problems rebuilding with maven maybe hitting this bug that was discovered during the update process at my company: #435467

[msgilligan]

I'm closing this as a duplicate of PR #426903. I will try to review that one.

[msgilligan]

This patch addresses a CVE from a few weeks ago, can it be merged?

From the CVE:

Difficult to exploit vulnerability allows

Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code

So probably doesn't affect too many Nixpkgs components if any at all.

[deftdawg]

So probably doesn't affect too many Nixpkgs components if any at all.

There were 3 highs (CVE-2025-30749, CVE-2025-50106, CVE-2025-50059) and a medium CVE (CVE-2025-30754) relating to 21.0.7, I just picked the first one on the list.

The company I work for has a policy of addressing "high" vulnerabilities within a week of when a fixed version is available, I personally recognize the risks are often theoretical, but I have to make an attempt.

Anyway thanks for taking the time to review the new PR. 🍻